Company
Software supply chain security company that analyzes open-source dependencies for vulnerabilities, malicious code, and package risk.
Tensorlake's npm SDK 0.5.144 carried a Shai-Hulud worm on October 8 that steals GitHub and npm tokens, cloud keys and AI coding-tool configs. A dev.to write-up of StepSecurity's teardown says revoking the stolen GitHub token triggers an rm -rf ~/, so the service must go first.
Reality
A time-of-check/time-of-use bug in the library many platforms use to run untrusted JavaScript lets guest code reach the host process. Fixes are in 6.2.0 and 7.0.1, and there is still no CVE.
Reality
GHSA-864f-rcv7-6rh4 lets guest code hand the C++ bindings one type on the first read and a different one on the second. Fixes are in 7.0.1 and 6.2.0.
Reality
An SC Media commentary builds its case from Verizon's 2026 breach data, JPMorgan's patch arithmetic and Endor Labs dependency counts. Every figure reaches operators secondhand, and the ratio of disclosed to patched is the one that survives the discount.
Reality
A J.P. Morgan report counts more than 1,400 AI-generated vulnerability reports that maintainers accepted at roughly 90% validation and mostly did not patch, which moves the budget question from finding to fixing.
Reality
A general resolution with eight options would turn "can we use AI here?" into project law. The exemptions matter more than the ban.
Reality
Endor Labs says a type confusion in isolated-vm's ExternalCopy turns a single ivm.Reference into host control-flow hijack. The remedy is a version bump to 7.0.1 or 6.2.0.
Reality
The poisoned keyv releases were signed by GitHub Actions and the attestation was accurate. It certified a build whose source had already been taken over.
Reality
The set runs from AI SAST to virtual patching. Harness has published no customer results, so the case rests on owning the pipeline rather than on detection quality.
Reality
The Linux Foundation's coalition for AI-generated vulnerability reports starts taking automated submissions next month. Its membership terms set the ceiling on what it can absorb.
Reality
GitHub's walkthrough has Amplitude, Endor Labs, LaunchDarkly and PagerDuty agents answering questions inside a single pull request. The integration point is now GitHub's agent harness.
Reality